> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plandalf.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization

Agents are users who are authorized to act on behalf of a customer.

Plandalf supports many different types of agent-customer relationships, such as:

* The Agent is the customer (1-1)
* The Agent is a member of a group which acts as the customer (many-1)
* The Agent is a member of multiple groups which belong to the same customer (1-many)
* The Agent is a member of multiple groups, where each group is a separate customer (many-many)

## JWT authorization

Plandalf SDK is authorized using a JWT signed with the api secret for your client.

## Claims

```yaml theme={null}
# Required Fields
sub: <USER_IDENTIFIER>

# Optional (but recommended) Fields
customer: <CUSTOMER_IDENTIFIER>
grp: <GROUP_IDENTIFIER>
exp: <TOKEN_EXPIRY_TIMESTAMP>
email: <USER_EMAIL_ADDRESS>

# Sandbox field (configures a 100% off coupon)
aud: sandbox
```

### Node.js

[jsonwebtoken](https://www.npmjs.com/package/jsonwebtoken) is a popular library for creating and verifying JWTs.

Install jsonwebtoken

```bash theme={null}
npm install jsonwebtoken
```

Create a JWT and pass it to your front end template

```js theme={null}
import jwt from 'jsonwebtoken';

let token = jwt.sign(claims, "<SECRET>", {algorithm: 'RS256', keyid: '<CLIENT_ID>'});
```

At this point, the JWT token can be passed to the front end template and used to initialize the plandalf SDK.

### PHP

```bash theme={null}
composer require firebase/php-jwt
```

```php theme={null}
use \Firebase\JWT\JWT;

$token = JWT::encode($claims, $secret, 'RS256', '<CLIENT_ID>');
```

## Example claims

```json theme={null}
{
    "sub": "user_abc123",
    "exp": 1721234567,
    "aud": "sandbox",
    "email": "foundo@plandalf.com",
    "customer": "cus_NffrFeUfNV2Hib",
}
```